DATA PROCESSING ADDENDUM TO THE AGREEMENT 
(DAX PUBLISHER PARTNER) 


THIS DATA PROCESSING ADDENDUM is made on the date of the Agreement. 


BETWEEN 


(1) 


(2) 


GLOBAL MEDIA GROUP SERVICES LIMITED a company incorporated in England and Wales under Company Number 03296557 
and with its registered office at 30 Leicester Square, London, WC2H 7LA ("Global"); and 


The party defined as “Partner” under the Agreement ("Partner"). 


RECITALS 


(A) 


1.1 


Global and Partner entered into an agreement for the provision of the Services under the Agreement ("Agreement"). Global 
and Partner have agreed to enter into this data processing addendum to supplement the Agreement in order to ensure that 
adequate safeguards are put in place with respect to the protection of Personal Data processed under the Agreement as 
required by Data Protection Laws ("Addendum"). 


This Addendum is intended to apply if and to the extent Global collects or otherwise processes the Personal Data of users 
belonging to Partner in connection with the Services. 


The terms in this Addendum (including the appendices) are incorporated into the Agreement and will be effective and replace 
any previously applicable terms relating to their subject matter from the Effective Date. 


Definitions and Interpretation 
The following expressions are used in this Addendum. 


“Appointed Sub-Processor” shall mean any Sub-Processer appointed by Global in connection with the provision of the 
Services as set out in Exhibit A; 


“Affiliate” shall mean means any subsidiary, any holding company or ultimate holding company of Global and any subsidiary 
of such holding company ("subsidiary" and "holding company" having the meanings given to them in the Companies Act 
2006); 


“Applicable Laws” shall mean the laws, regulation and other similar instruments applicable to Global or the Partner; 


“The terms, "Controller", "Data Subject", "Personal Data", "Personal Data Breach", "Processor", "Processing" and 
"Supervisory Authority" shall have the same meaning as in the UK GDPR, and their cognate terms shall be construed 
accordingly. Terms defined in the UK GDPR, shall have the same meaning when used in this Agreement, unless defined in 
this Agreement. 


"Data Protection Laws" means the UK Data Protection Laws and any other applicable data protection and privacy legislation 
and regulatory requirements in force from time to time; 


“Effective Date” means the effective date specified in the Agreement; 


“GDPR” means the General Data Protection Regulation ((EU) 2016/679); 


“Partner Data” means any Personal Data in respect of which Partner is a data controller that is processed by Global in 
connection with its performance of the Services; 


“Services” means the services provided by Global under the Agreement between the Partner and Global; 


1.2 


2.2. 


4.1. 


4.2. 


5. 


5.1. 


5.2. 


“UK Data Protection Laws” means all applicable data protection and privacy legislation in force from time to time in 
the UK including the UK GDPR; the Data Protection Act 2018; the Privacy and Electronic Communications Regulations 2003 
(as amended); and the regulatory requirements of the ICO; and 


“UK GDPR” means the GDPR as retained in UK law pursuant to the European Union (Withdrawal) Act 2018. 


The words "include" and "including" shall not be interpreted as limiting the generality of any foregoing words. 


Addendum and Status of Parties 


This Addendum shall be in full force and effect from the Effective Date. 


Partner acknowledges and agrees that Partner is the Controller of the Partner Data processed by Global in its performance of 
the Services, and that Global shall act as Processor in its performance of the Services. Accordingly, save where otherwise 
required under Applicable Laws, Global shall only process Partner Data as set out in Exhibit A: (a) on behalf of and for the 
benefit of Partner; and (b) in accordance with Partner’s reasonable written instructions. Where Global is required by 
Applicable Laws to process Partner Data otherwise than in accordance with (a) and (b), Global shall, to the extent permitted 
by Applicable Laws, inform Partner of the legal requirement before the relevant processing of the Partner Data. 


Authorisation to Share Partner Data 


Partner acknowledges and agrees that Global may process and share Partner Data to any person or entity as follows: (a) to 
contractors, agents and other third parties (including Global Affiliates) which act as subcontractors for the purpose of providing 
the Services (such parties being “Sub-Processors”) as set out in clause 5; (b) to contractors, agents and other third parties which 
act as independent Controllers in connection with Services and process the Personal Data for purposes and through means 
which they determine (such parties being “Authorised Controllers”) as set out in clause 6; and (c) as reasonably necessary for 
the provision of the Services and consistent with the Agreement. 


Partner Representations, Warranties and Covenants 


Partner represents, warrants, and covenants: (a) it shall provide Personal Data in compliance with Applicable Laws; (b) that a 
user or listener has actively consented to the processing of his or her Personal Data; (c) all requests for consent shall comply 
with the requirements under Data Protection Laws including that it shall be presented in a manner which is clearly 
distinguishable from other matters, in an intelligible and easily accessible form, using clear, and plain language; and (d) the 
Partner Data shall be up to date, accurate, and complete. Partner shall have sole responsibility for the accuracy, quality, and 
legality of Partner Data, and the means by which it acquired Partner Data and established consent as the legal basis for 
processing under Data Protection Laws. 


Partner acknowledges and agrees (a) Data Subjects shall have the right, and shall have been informed of the right, to withdraw 
their consent at any time; (b) if applicable, it shall inform Global of any rights enforced by Data Subjects relevant to the 
Personal Data processed under the Services, including the withdrawal of consent; and (c) it will update and notify Global of 
any modification to any distribution means (i.e. player) and provide such information in a manner reasonably acceptable to 
Global. 


Use of Sub-Processors 


Partner authorises Global and each Global Affiliate to appoint (and permits each Sub-Processor appointed in accordance with 
this clause 5 to appoint) Sub-Processors in accordance with this clause 5 and any restrictions in the Agreement. 


Global may continue to use those Sub-Processors already engaged by Global as at the date of this Agreement, including the 
appointment of any Appointed Sub-Processor. Global shall give Partner written notice of the appointment of any new Sub- 
Processor, including details of the processing to be undertaken by the Sub-Processor. If, within thirty (30) days of receipt of 
that notice, Partner notifies Global in writing of any objections (on reasonable grounds) to the proposed appointment, Global 
shall not appoint or disclose any Partner Data to that proposed Sub-Processor until reasonable steps have been taken to 
address the objections raised by any Partner and Partner has been provided with a reasonable explanation of such steps. 


5.3. Where any Appointed Sub-Processor of Global will be processing Partner Data on behalf of the Partner, Global shall ensure 


6.1. 


6.2. 


7. 


7.1. 


7.2. 


8.1. 


8.2. 


10. 


10.1. 


that a written contract exists between Global and the Appointed Sub-Processor containing clauses substantially similar to 
those imposed on Global in this Agreement. 


Transfers of Personal Data to Controllers 


Partner authorises Global and each Global Affiliate to transfer Partner Data to Authorised Controllers where necessary for 
Partner to receive the Services. The parties set out each Authorised Controller and its purpose for processing the Partner 
Data, more specifically, the Personal Data in Exhibit B. The parties agree that the list of Authorised Controllers may be updated 
from time to time where there are changes made within the DAX ecosystem. Global shall notify Partner each time, where 
email shall suffice, when the list at Exhibit B is updated. A new Authorised Controller is deemed accepted if the Partner 
doesn`t object within fourteen (14) days after receiving the notification from Global. 


The Partner may at any time amend or withdraw the instructions set out in this clause 6 in relation to one or more of the 
Authorised Controllers by providing no less than (thirty) 30 days prior written notice to Global by emailing to the following 
address DAX-GDPR@global.com in accordance with the terms of the Agreement. To the extent to which they are available 
and not subject to any confidentiality obligations, Global may provide details to Partner of the use made of Partner Data by 
each Authorised Controller in its capacity as Controller if requested. 


Transfer of Personal Data outside of the UK 


Global agrees not to transfer Partner Data to, or process such data (in each case referred to hereafter as a “Transfer”) in, a 
location outside of the United Kingdom (UK) (other than exclusively in the European Economic Area or in an Adequate 
Country), without Partner’s prior written consent which shall not be unreasonably withheld or delayed. 


For the purposes of this clause 7, Partner hereby consents to Transfers outside of the UK or EEA to a third country where: (a) 
Global or an Appointed Sub-Processor (as the case may be) has entered into standard contractual clauses for the transfer of 
Personal Data to Processors established in third countries, as approved by the European Commission and/or the ICO (where 
applicable), with Partner (or a Partner Affiliate) as the data exporter; (b) Global or its Sub-Processor (as the case may be) has 
Binding Corporate Rules, approved by the Supervisory Authority; (c) such Transfer is subject to an adequacy decision by the 
European Commission; or (d) where the Transfer otherwise complies with Data Protection Laws. 


Security 


Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing 
the Partner Data as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Global 
shall in relation to the Partner Data implement appropriate technical and organizational measures to ensure a level of security 
appropriate to that risk, including, as appropriate, the measures referred to in the UK GDPR. 


In assessing the appropriate level of security, Global shall take account the risks that are presented by processing Personal 
Data, in particular from a Personal Data Breach. 


Security Incidents and Notices to Third Parties 


Global shall notify Partner without undue delay upon Global becoming aware of a Personal Data Breach affecting Partner 
Data and shall provide Partner with such reasonable co-operation and assistance as may be required to comply with any 
reporting obligations which may apply in respect of any such Personal Data Breach. Any such assistance required by Global 
under this clause 9 shall be at the cost of Partner. 


Assistance 


Taking into account the nature of the processing, Global shall assist Partner by implementing appropriate technical and 
organizational measures, insofar as this is possible, for the fulfilment of the Partner’s obligations, as reasonably understood 
by the Partner, to respond to requests to exercise Data Subject rights under Data Protection Laws. 


10.2. 


10.3. 


11. 


11.1. 


11.2. 


11.3. 


11.4. 


12. 


13. 


Taking into account the nature of the processing and the information available to Global, Global shall assist Partner in ensuring 
compliance with Partner’s obligations in respect of security of Personal Data, data protection impact assessments and prior 
consultation requirements under Data Protection Law. 


Global shall: (a) promptly notify Partner if it or its Sub-Processors receive a request from a Data Subject under any Data 
Protection Law in respect of Partner Data; and (b) ensure that it and its Sub-Processors do not respond to that request except 
on the documented instructions of Partner or as required by Applicable Laws to which it or its Sub-Processor is subject, in 
which case Global shall to the extent permitted by Applicable Laws inform Partner of that legal requirement before it or its 
Sub-Processor responds to the request. Partner acknowledges and agrees that any assistance required by Global beyond the 
requirements of the Applicable Laws shall be at the sole cost of Partner. 


Deletion or Return of Partner Data 


Global shall retain copies of the Partner Data for a period of ninety (90) days (the “Retention Period”) from the date of 
termination of the Agreement. On expiry of the Retention Period, Global shall promptly delete and procure the deletion of all 
copies of Partner Data. 


Partner may in its absolute discretion by written notice to Global require Global to (a) return a complete copy of all Partner 
Data to Partner by secure file transfer in such format as is reasonably notified by Partner to Global; and (b) save as otherwise 
set out in this clause 11, delete and procure the deletion of all other copies of Partner Data processed by it or an Appointed 
Sub- Processor. 


Global and each Appointed Sub-Processor may retain Partner Data to the extent and for such period as required by Applicable 
Laws; provided that Global shall ensure the confidentiality and anonymity of all such Partner Data and that such Partner Data 
is only processed as necessary for the purpose(s) specified in the Applicable Laws and Services requiring its storage and for no 
other purpose. 


Global shall, at the request of the Partner, provide written certification to Partner that it has fully complied with this clause 11 
within thirty (30) days of the expiry of the Retention Period upon receipt of a written request. 


Right to Monitor 


Upon sixty five (65) days’ prior written notice by Partner, at Partner’s expense, Global shall grant Partner (or a mutually 
acceptable independent auditor) permission to perform an assessment, audit, examination or review (commonly an 
“Assessment”) of all controls in Global’s organizational, physical and/or technical environment in relation to all Partner Data 
being processed and/or services being provided to Partner pursuant to the Agreement. Such Assessment shall be carried out 
no more than once per year. Global shall cooperate with such Assessment by providing reasonable access to knowledgeable 
personnel, physical premises, documentation, infrastructure and application software that processes, stores or transfers 
Partner Data pursuant to the Agreement, showing how Global complies with its obligations related to privacy and data 
security under the Agreement (including this Schedule. In addition, upon Partner's prior written request, Global shall provide 
Partner with the results of any audit performed by or on behalf of Global that assesses the effectiveness of Global’s 
information security program as relevant to the security and confidentiality of Partner Data shared during the course of the 
Agreement. Global acknowledges and agrees that Supervisory Authorities may request information from Global and carry 
out investigations in the form of data protection audits of Global, in accordance with Applicable Laws (commonly “Authority 
Assessments”). To the extent legally permissible, Global shall notify Partner promptly, giving full details of Global’s concerns, 
if it considers any request by Partner under this clause 12 infringes Applicable Laws. 


Conflicts 


In the event of any conflict between this Schedule and the Agreement, these terms will govern solely with respect to the 
subject matter hereof. 


EXHIBIT A 


DATA PROCESSING DETAILS 


Duration of the processing: 


The duration of the processing will be until the expiry of the Agreement. 


Nature and purpose of the processing: 


The processing is made for the following purposes: 


The trading of Partner’s inventory and management of the resulting campaigns through Global’s proprietary ad-serving 
platform and chosen third party partners. 


Type of Personal Data: 


The Personal Data processed concern the following categories of data: 


e Identifiers: email address, IP Address, information that may be used for device fingerprinting, geo-location (e.g. 
latitude & longitude); 


e Demographic information: location, age range, gender and other client-specified demographics; and 


e Behavioural information: inferences or specific information about users’ product interests, website browsing 
information, online purchases and website registrations. 


Categories of Data Subjects: 


The Personal Data processed concern the following categories of Data Subjects: 


Users of the relevant technologies, players and/or platforms as owned, operated or used by the Partner to serve such users 
with Partner’s services. 


Processing Instructions 


Any specific processing instructions given by Partner to Global in writing with respect to Partner Data. 


Appointed Sub-Processors 


Demand Side Platform (DSP) Sub-Processors: 


In accordance with clause 5, Partner authorises Global and each Global Affiliate to use the following Appointed Sub- 
Processors in respect of the Personal Data processed under the Agreement for the purposes of allowing a single point of 
access and purchase of advertising inventory through a DSP. 


Adobe Systems Incorporated 
Adswizz Inc (t/a Audiomatic) 
Bidswitch GmBH 

Xandr 

The Trade Desk 

Tambo 


Ale li a 


EXHIBIT B 
AUTHORISED CONTROLLERS 
In accordance with clause 6, Partner authorises Global and each Global Affiliate to transfer the Personal Data under this 
Agreement to each of the following Demand Side Platforms (DSPs), which regard themselves as a Controller for the 


purpose of trading Partner’s inventory through Global’s proprietary ad-serving platform and chosen third party partners. 
(“Controller Processing Purposes”). 


Authorisied Controllers 


The TradeDesk 


Xandr (AppNexus) 


Google DV360 


MediaMath 


Verizon - Oath 


Yahoo 


